Khaled Alenazi

Name of the Vulnerable Software and Affected Versions The Order Notification for WooCommerce WordPress plugin versions prior to 3.6.3 Description The Order Notification for WooCommerce WordPress plugin before version 3.6.3 bypasses WooCommerce's permission checks, granting full access to all unauthenticated requests. This allows complete read and write access to store resources, including products, coupons, and customer data. Recommendations Update the Order Notification for WooCommerce WordPress plugin to version 3.6.3 or later.

**Name of the Vulnerable Software and Affected Versions** Restaurant Cafeteria WordPress theme versions through 0.4.6 **Description** The WordPress theme allows any logged-in user, including those with subscriber privileges, to perform actions intended for more privileged roles due to missing security checks. Specifically, insecure admin-ajax actions lack nonce and capability verification. This allows an attacker to install and activate plugins from URLs controlled by the attacker, potentially leading to arbitrary PHP code execution. The theme also allows importing demo content that can overwrite site configurations, including pages, menus, and front page settings. **Recommendations** Update Restaurant Cafeteria WordPress theme to a version newer than 0.4.6.

**Name of the Vulnerable Software and Affected Versions** Timetics WordPress plugin versions prior to 1.0.52 **Description** The Timetics WordPress plugin does not have proper authorization checks on a REST endpoint. This allows unauthenticated users to modify a booking's payment status and post status for the 'timetics-booking' custom post type. The vulnerable endpoint allows arbitrary changes to booking information. The vulnerable endpoint is a REST endpoint. The `timetics-booking` custom post type is affected. **Recommendations** Update the Timetics WordPress plugin to version 1.0.52 or later.

**Name of the Vulnerable Software and Affected Versions** Datalogics Ecommerce Delivery WordPress plugin versions prior to 2.6.60 **Description** The Datalogics Ecommerce Delivery WordPress plugin before version 2.6.60 has an unauthenticated REST endpoint that allows remote users to modify the `datalogics token` option without authentication. This token is then used to authenticate requests to a protected endpoint, enabling arbitrary WordPress `update option()` operations. An attacker can leverage this to enable registration and set the default user role to Administrator. The affected plugin exposes an unauthenticated REST endpoint. The vulnerable parameter is `datalogics token`. **Recommendations** Update the Datalogics Ecommerce Delivery WordPress plugin to version 2.6.60 or later.

**Name of the Vulnerable Software and Affected Versions** PowerPack for LearnDash WordPress plugin versions prior to 1.3.0 **Description** The PowerPack for LearnDash WordPress plugin lacks authorization and Cross-Site Request Forgery (CSRF) checks in an AJAX action. This allows unauthenticated users to modify arbitrary WordPress options, such as `default role`, and create new administrator users. **Recommendations** Update the PowerPack for LearnDash WordPress plugin to version 1.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Login with Salesforce WordPress plugin version 1.0.2 **Description** The Login with Salesforce WordPress plugin does not properly validate user access permissions when logging in through Salesforce. This allows unauthenticated users to authenticate as any user, including administrators, simply by knowing their email address. **Recommendations** Update the Login with Salesforce WordPress plugin to a version beyond 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Prime Listing Manager WordPress plugin versions through 1.1 **Description** The Prime Listing Manager WordPress plugin allows an attacker to gain administrative access without needing an account on the targeted site and perform unauthorized actions. This is due to a hardcoded secret. **Recommendations** Update Prime Listing Manager WordPress plugin to a version newer than 1.1.

**Name of the Vulnerable Software and Affected Versions** Post Slides versions through 1.0.1 **Description** The software does not properly check shortcode attributes before using them to create file paths for inclusion, potentially allowing authenticated users with contributor or higher privileges to carry out Local File Inclusion (LFI) attacks. **Recommendations** Update Post Slides to a version later than 1.0.1.

**Name of the Vulnerable Software and Affected Versions** Bookingor WordPress plugin versions through 1.0.12 **Description** The Bookingor WordPress plugin through version 1.0.12 contains a flaw where authenticated AJAX actions lack proper capability and nonce checks. This allows users with limited privileges to delete Bookingor data. **Recommendations** Update the Bookingor WordPress plugin to a version later than 1.0.12.

**Name of the Vulnerable Software and Affected Versions** E-xact | Hosted Payment | WordPress plugin versions through 2.0 **Description** The E-xact | Hosted Payment | WordPress plugin through version 2.0 contains a flaw due to inadequate file path validation, allowing unauthenticated attackers to delete arbitrary files on the server. The vulnerability enables file deletion without requiring authentication. **Recommendations** Update E-xact | Hosted Payment | WordPress plugin to a version later than 2.0.

**Name of the Vulnerable Software and Affected Versions** The Dreamer Blog WordPress theme versions through 1.2 **Description** The Dreamer Blog WordPress theme is affected by a flaw that allows for arbitrary installations due to the absence of a proper capability check. **Recommendations** Update The Dreamer Blog WordPress theme to a version later than 1.2.

**Name of the Vulnerable Software and Affected Versions** Knowband Mobile App Builder WordPress plugin versions prior to 3.0.0 **Description** The plugin lacks proper authorization checks when deleting users through its REST API. This allows unauthenticated attackers to delete any user. The vulnerable API endpoint allows for arbitrary user deletion without authentication. The affected API endpoint is used for user management. **Recommendations** Update to version 3.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** Pure WC Variation Swatches WordPress plugin versions through 1.1.7 **Description** The Pure WC Variation Swatches WordPress plugin does not perform authorization checks when updating its settings. This allows any authenticated user to modify these settings. **Recommendations** Update the Pure WC Variation Swatches WordPress plugin to a version later than 1.1.7.

**Name of the Vulnerable Software and Affected Versions** HelloLeads CRM Form Shortcode WordPress plugin versions through 1.0 **Description** The HelloLeads CRM Form Shortcode WordPress plugin does not properly verify authorization or include CSRF protection when resetting its settings. This allows unauthenticated users to reset the plugin’s settings. **Recommendations** Update HelloLeads CRM Form Shortcode WordPress plugin to a version beyond 1.0.

**Name of the Vulnerable Software and Affected Versions** Construction Light WordPress theme versions prior to 1.6.8 **Description** The Construction Light WordPress theme lacks proper authorization and Cross-Site Request Forgery (CSRF) protection when activated through an AJAX action. This allows any authenticated user, even those with limited privileges like a subscriber, to activate arbitrary functionality. The vulnerable action involves an AJAX request that does not verify user permissions or include CSRF tokens, enabling unauthorized activation of features. **Recommendations** Update the Construction Light WordPress theme to version 1.6.8 or later.

**Name of the Vulnerable Software and Affected Versions** Bookit WordPress plugin versions prior to 2.5.1 **Description** The Bookit WordPress plugin contains a publicly accessible REST endpoint that allows unauthenticated modification of the plugin's Stripe payment settings. This allows attackers to alter the Stripe payment options without any authentication. The affected endpoint is a REST API. The vulnerable parameter is related to Stripe payment options. **Recommendations** Update the Bookit WordPress plugin to version 2.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** WooMulti WordPress plugin versions through 17 **Description** The plugin does not properly check a file parameter during file deletion, potentially allowing authenticated users, even those with limited privileges like subscribers, to delete any file on the server. The affected API endpoint is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified. **Recommendations** Update WooMulti WordPress plugin to a version later than 17.

**Name of the Vulnerable Software and Affected Versions** TAX SERVICE Electronic HDM WordPress plugin versions prior to 1.2.1 **Description** The TAX SERVICE Electronic HDM WordPress plugin does not perform authorization and Cross-Site Request Forgery (CSRF) checks in an AJAX action. This allows unauthenticated users to import and execute arbitrary SQL statements. The issue involves a lack of security measures that should prevent unauthorized access and manipulation of the database. **Recommendations** Update the TAX SERVICE Electronic HDM WordPress plugin to version 1.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mstoreapp Mobile App WordPress plugin versions through 2.08 Mstoreapp Mobile Multivendor versions through 9.0.1 **Description** The plugins do not properly validate user identity when an AJAX action is used. This allows unauthenticated users to obtain a valid session for any user if they know the user's email address. The affected API endpoint is not specified. The vulnerable parameter is the `email address` used to retrieve user sessions. **Recommendations** Update Mstoreapp Mobile App WordPress plugin to a version later than 2.08. Update Mstoreapp Mobile Multivendor to a version later than 9.0.1.

**Name of the Vulnerable Software and Affected Versions** Creta Testimonial Showcase WordPress plugin versions prior to 1.2.4 **Description** The Creta Testimonial Showcase WordPress plugin is susceptible to a Local File Inclusion issue. Attackers with editor-level access or higher can include and execute arbitrary files on the server, potentially executing PHP code within those files. **Recommendations** Update the Creta Testimonial Showcase WordPress plugin to version 1.2.4 or later.